I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time I doubt the maker of your software will fare much better over the long term.
LinkedIn password leak
191–200 of 218 posts
Re: LinkedIn password leak
#192Earlier quoted context omitted.
Or for an unhashed password database, c.f. http://plaintextoffenders.com/ .
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
But the mail is stored!
Re: LinkedIn password leak
#193I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time…
This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're screwed anyway and so that single basket doesn't really matter anymore.
If an attacker has sufficient access to read out passwords from RAM, it also has sufficient access to just keylog everything.
To follow your analogy: if somebody physically breaks into your home and places a security camera pointed at your safe(s), it's not really going to matter for the average user whether all the safe combinations are on a single piece of paper.
They're going to get them anyway, because they've compromised the environment and can just watch the footage.
Re: LinkedIn password leak
#1941: Change your password. RIGHT NOW. If you’re not sure how strong your password is, test sample passwords with our password checker here. Seriously? Keep in mind that these estimates are based on some bogus entropy estimation. If a password hacking guy runs the correct dictionary past the hashes you password generates, it might be as small, well, as the first one tried. For example, run the passphrase Ph'nglui mglw'n…
As an aside, it can be so difficult to get this across to folks who aren't in the infosec headspace. I've seen even technical, computer science types absolutely not get that their ad-hoc memorable password "but no one would EVER guess that!" schemes are probably much more vulnerable than they estimate. Nevermind, even, true computing laypersons.
I've found that it helps to, rather than going directly into the mathematics of it all, explain to somebody that their password is going to be cracked by a computer rather than a human, and computers 'think differently'. Thus, you need to make things that seem complex to computers, not things that seem complex to humans.
The same applies verbatim for people trying to roll their own 'clever' encryption schemes.
Re: LinkedIn password leak
#195Earlier quoted context omitted.
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
But the mail is stored!
Fortunately, the mail is not typically stored in the user database, so acquiring it would take at least a separate leak.
Re: LinkedIn password leak
#196Earlier quoted context omitted.
Why do people insist on using sms as the second factor? Let me use TOTP (e.g. Google Authenticator). I don't get reception everywhere!
I get you - but how many places do you not get sms reception but you still have enough internet connection to be trying to log in to LinkedIn? (Inside a data center, maybe?)
Plenty of places around London where I have WIFI access but no 3G/4G signal (tube stations, various Starbucks, couple of Costas, my flat, DB's Bishopgate office in 2014, etc.)
It makes e.g. Twitter's insistence on SMS 2FA annoying (since their "we've sent you login request to your app" just doesn't work for me, I'm stuck with SMS).
Re: LinkedIn password leak
#197Earlier quoted context omitted.
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
But the mail is stored!
By you, right? Or is it common practice to store outgoing mails?
Re: LinkedIn password leak
#198Earlier quoted context omitted.
We have to rotate our password advice to family and friends every couple years or so. It used to be "use a random combination of memorable words with a number thrown in" a la "reddogbarkhard7". Now I feel like right after guessing the 10k most common passwords a hacker would immediately brute word combinations with a single integer ending.
The worst bias is letting the users choose their passwords. They should use a generator such as [1]. The reason is that the "entropy" is not a characteristic of a password but of the way it is generated. Computers are much better at entropy than humans. [1] http://passwordcreator.org/
What could possibly go wrong: This page was served over an insecure connection. It could have be forged or altered in transit. In red letters.
There is a certain degree of trust that non-technical users are asked to do that should leave us with at least a mild level of discomfort.
Re: LinkedIn password leak
#199Earlier quoted context omitted.
That is a good choice, and it is what I recommend to whoever will listen to me, and a few that won't. I use and recommend 1Password. To evaluate a password manager, check this page https://discussions.agilebits.com/discussion/15416/1password... for good questions to ask. For example, what data they can turn over, what their encryption practices are. Key phrase: "There is no data of yours that we keep, so there is not…
That's an old and outdated page. 1Password has moved to a subscription model, thus storing the encrypted database themselves. The old "offline" option is still around, but it has been deemphasized, for one because they stopped implementing features supporting it (like an offline HTML interface for opvault, or sync with other clouds besides Dropbox). Even more upsetting is that the standalone version is now much more…
Well not quite. While they have added a subscription model, there is still the desktop-only version that works in accordance with that page.
I didn't notice an increase in their price--I have one at home and one from work.
Re: LinkedIn password leak
#200Earlier quoted context omitted.
Or for an unhashed password database, c.f. http://plaintextoffenders.com/ .
The fact that your password is mailed in plain text to you when you register does not prove the password is not hashed when it's stored. In a "lost password" mail, of course, that's another thing.
A moot point. If they are sending your password across anything in plaintext, you just immediately lost a lot of the advantage you got from storing the password hashed.